October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115485 A flaw was found in the iscsiuio component of open-iscsi. |
medium | 6.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115534 A vulnerability was determined in gedelumbung HospitalManagement up to c2d455437... |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-96616 Authentication tokens issued by the E3's web management interface on login are g... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115221 A flaw was found in FreeIPA. |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115424 A flaw was found in the OpenShift client oc. |
medium | 5.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114620 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
medium | 5.4 | — | Authlib / authlib | 2026-10-22 | 2026-10-30 |
| CVE-2026-114617 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
medium | 4.2 | — | Authlib / authlib | 2026-10-22 | 2026-10-29 |
| CVE-2026-114618 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
medium | 6.8 | — | Authlib / authlib | 2026-10-22 | 2026-10-29 |
| CVE-2026-114619 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
medium | 4.6 | — | Authlib / authlib | 2026-10-22 | 2026-10-29 |
| CVE-2026-111100 The ONVIF device service on the E3 responds to certain informational requests wi... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-105265 A vulnerability exists in the the time zone parameter and does not properly vali... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115509 Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerab... |
medium | 4.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115398 Ghidra before 12.2 contains a resource allocation without limits vulnerability i... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-115503 Ghidra before 12.2 contains an improper handling of highly compressed data vulne... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-115508 Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexit... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-95718 An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95719 An arbitrary file deletion vulnerability exists in the command line interface of... |
medium | 4.9 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95720 A buffer overflow vulnerability exists in AOS-8 that could allow an authenticate... |
medium | 4.4 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95714 A buffer overflow vulnerability exists in the API of AOS-10 that could allow an... |
medium | 6.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95715 An unauthenticated command injection vulnerability exists in the command line in... |
medium | 6.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95716 An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticate... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95717 A stored cross-site scripting (XSS) vulnerability exists in the web-based manage... |
medium | 5.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115394 Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-115395 Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerabil... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-115396 Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-115397 Ghidra before 12.2 contains a resource allocation without limits vulnerability i... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-115387 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains... |
medium | 6.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115388 wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0... |
medium | 6.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115390 Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accountin... |
medium | 5.7 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115391 Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled... |
medium | 5.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115381 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115382 Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-serv... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115383 Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper vali... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115385 Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of serv... |
medium | 6.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115378 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbit... |
medium | 5.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115379 Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC roo... |
medium | 5.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115380 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains... |
medium | 4.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115370 Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115373 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missin... |
medium | 6.3 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115360 OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC id... |
medium | 4.7 | — | — | 2026-10-22 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.